构建 splunk 4.0“应用程序” - 有反馈吗？
我正在考虑构建一个应用程序以插入 Splunk 4进行自定义数据收集、自定义、报告等（就像我看到其他 splunk 应用程序所做的那样），但专注于 .NET 和 J2EE Web 应用程序。我正在寻找提示、技巧、最佳实践等，以帮助我超越在 splunk 文档中找到的内容。
有人有关于构建 splunk 4 应用程序的良好链接列表和/或个人经验反馈吗？
I'm considering building an app to plug into Splunk 4 to do custom data collection, custom, reporting, etc. (like I see other splunk apps doing) but focused on .NET and J2EE web apps. I'm looking for hints, tips, best practices, etc. to give me a leg up beyond what I can find in the splunk documentation.
Anyone have a good list of links and/or personal experience feedback about building a splunk 4 app?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我是 Splunk 开发人员手册的编写者，我很高兴为您提供帮助。我们始终致力于使我们的文档更加清晰和有用。您看过开发人员文档了吗？如果您已经找到但尚未找到所需的内容，我想听听。如果您还没有，那么您可能会找到一些有用的提示。
最好的起点是 App Builder。有一个示例应用程序模板，其中已经内置了一堆视图和保存的搜索。您可以更改它们，以便它们适合您的用例，并添加几个数据输入来读取您想要索引的数据（在您的情况下，.NET 和 J2EE）。然后，看看您可以在此数据之上构建哪些简洁的搜索和报告，并构建仪表板和表单搜索，以显示您所输入的数据输入中的有用信息。
还有更多内容，但这是一个很好的地方开始。请随时给我发电子邮件、查看 Splunk IRC 频道或在 Splunk 论坛上发帖以获得更多帮助。支持门户有更多信息：
http://www.splunk.com/support
干杯，
艾玛
I'm the Splunk Developer Manual writer, and I'm happy to give you help. We are always working on making our documentation more clear and helpful. Have you looked at the Developer docs yet? If you have but haven't found what you're looking for, I'd like to hear about it. If you haven't then you might find some helpful hints.
The best place to start is with App Builder. There's a sample App template that has a bunch of views and saved searches built in already. You can change these so they fit your use case, and add a couple data inputs that read in the data you want to index (in your case, .NET and J2EE). Then, see what neat searches and reports you can build on top of this data, and build out dashboards and form searches that showcase the useful information from the data inputs you've pulled in.
There's more to it, but that's a good place to start. Feel free to email me, check out the Splunk IRC channel, or post on Splunk's forums for more help. The Support portal has more info:
http://www.splunk.com/support
Cheers,
Emma
构建 Splunk 应用程序已有大约三个月的时间。总体来说很容易。对我们来说最困难的事情之一是使应用程序在分布式环境中易于使用。所以我们有三个不同的应用程序；一个用于转发器、索引器和搜索头。
我们已经在 Java 环境中获取 log4j/slf4j 输出一段时间了。没有任何麻烦。只是尽量不要让字段提取与日志格式紧密结合，因为日志格式可以更改。
在我们的环境中，找出派生事件非常有用，例如 Tomcat 何时重新启动以及 Web 应用程序何时无法部署。
Been building Splunk apps for around three months. Pretty easy overall. One of the most difficult things for us is making the app easy to use in a distributed environment. So we have three different apps; one for the forwarder, indexer and search head.
We've been in a Java environment, picking up log4j/slf4j output for a while. No trouble whatsoever. Just try to not make your field extraction tightly coupled with log format, since the log format can be changed.
In our environment, it's useful to figure out derived events, like when tomcat restarts, and when a webapp fails to deploy.
嘿，cmonkey - 听起来棒极了。我想和您谈谈您的应用程序构建经验。
我是 Splunk 社区人员，我负责与像您这样的人讨论如何在 Splunkbase.com 上发布您的内容。如果您想在不久的将来进行讨论，请告诉我。
Hey cmonkey - that sounds awesome. I'd like to talk to you re: your app-building experience.
I'm the Splunk community guy, and I'm responsible for talking to guys like you about posting your stuff on Splunkbase.com. Let me know if you'd like to discuss in the near future.